#!/usr/bin/env python

from subprocess import *
import re
import variaveis

def getTSKVolumes(pImagem):
    
    lsCom = variaveis.PATH_TSK + "\mmls.exe "
    #so eh compativel com a 2.7
    #lsSaida = subprocess.check_output([lsCom, pImagem]) 
    lsSaida = Popen([lsCom, pImagem], stdout=PIPE).communicate()[0]
    
    #captura os offsets de cada volume
    p = re.compile(r'\d+:\s+(\d+:\d+)\s+(\d+)\s+(\d+)\s+(\d+)\s+(\w+\s*)+(.*)', re.IGNORECASE)
        
    ltTodos = p.findall(lsSaida)
    
    try:
        llVol = [int(f[1]) for f in ltTodos]
    except:
        #a imagem eh fisica e nao tem offset
        llVol = [0]
    
    return llVol


def getTSKFSInfo(pImagem, pOffset):
    lsCom = variaveis.PATH_TSK + r"\fsstat.exe "
    #so eh compativel com a 2.7
    #lsSaida = subprocess.check_output([lsCom, pImagem])
    
    if pOffset == 0:
        lsSaida = Popen([lsCom,pImagem], stdout=PIPE).communicate()[0]
    else:
        lsSaida = Popen([lsCom, '-o', str(pOffset), pImagem], stdout=PIPE).communicate()[0]
    
    p = re.compile(r'File System Type:\s+(\w+)', re.IGNORECASE)
    
    llTodos = p.findall(lsSaida)
    
    return llTodos[0]
    
def getTSKInode(pImagem, pOffset, pItem):
    ldInodes = {'$AttrDef' : '4',
                '$BadClus' : '8-128-2', 
                '$BadClus:$Bad' : '8-128-1',
                '$Bitmap' : '6',
                '$Boot' : '7',
                '$Extend' : '11',
                '$LogFile' : '2',
                '$MFT' : '0',
                '$MFTMirr' : '1',
                '$Secure:$SDS' : '9-128-8',
                '$Secure:$SDH' : '9-144-11',
                '$Secure:$SII' : '9-144-14',
                '$UpCase' : '10',
                '$Volume' : '3'
                }
    
    lsInode = ldInodes.get(pItem)
    
    if lsInode == None:
        lsCom = variaveis.PATH_TSK + r"\ifind.exe "
        #so eh compativel com a 2.7
        #lsSaida = subprocess.check_output([lsCom, pImagem])
    
        if pOffset == 0:
            lsSaida = Popen([lsCom, '-n', pItem, pImagem], stdout=PIPE).communicate()[0]
        else:
            lsSaida = Popen([lsCom, '-o', str(pOffset), '-n', pItem, pImagem], stdout=PIPE).communicate()[0]
    
        if lsSaida <> "File not found":
            lsInode = lsSaida
            
    return lsInode


def getTSKDados(pImagem, pOffset, pInode):
    lsCom = variaveis.PATH_TSK + r"\icat.exe "
    #so eh compativel com a 2.7
    #lsSaida = subprocess.check_output([lsCom, pImagem])
    
    if pOffset == 0:
        lsSaida = Popen([lsCom, pImagem, pInode], stdout=PIPE).communicate()[0]
    else:
        lsSaida = Popen([lsCom, '-o', str(pOffset), pImagem, pInode], stdout=PIPE).communicate()[0]

    return lsSaida